Security
The questions a bank’s security team asks first, answered in the order they ask them. The assurance status (audits, tests, certifications) is kept on one line of Status so that nothing here can be read as a certification claim.
Keys
| Key | Where it lives | What it does |
|---|---|---|
| Regent’s signing keys (tokens, receipts, checkpoints) | a cloud key management service; the private key never leaves it and is never on a disk or in a container | signs every allow token, receipt and audit checkpoint; the public keys are at https://control-api.regentprotocol.org/v1/control/.well-known/jwks.json |
| An agent’s key | the agent’s own machine (it generates the key and registers the public half), or held in custody for it when the agent cannot hold one | signs the agent’s requests (RFC 9421); every receipt names which case applied (key_custody) |
| The owner’s passkey | the owner’s device, with the device’s own hardware protection | signs mandates and escalation approvals; Regent holds the public key only |
| Provider credentials (Stripe keys, API keys of tools) | Regent’s vault for the Cloud Gateway, or your own sidecar when you self-host; put there by a person, never by an agent | injected into the call after an allow; the agent never sees them |
| Host secrets (database passwords, service tokens) | encrypted at rest, decrypted only into the memory of the service that starts | — |
An organization key (rgnt_…) is for people and their servers. An agent never holds one: it acts
with its own credential or a one-hour token from a connector sign-in, bound to that one agent.
What leaves Regent, and what never does
Goes to a public chain (Solana, and Bitcoin for timestamps): hashes only. The hash of an agent’s identity payload, a commitment to a mandate’s terms, Merkle roots of audit batches, the hash of a checkpoint. Never an amount, a ceiling, a name, an address, a payload.
Goes to a counterparty (a merchant, a PSP, a custodian): the decision for the money movement it executes, and the signed allow token when the rail verifies one. Never the mandate’s ceilings, never the owner’s identity.
Goes to the owner and whoever they choose: receipts, mandate reveals, evidence bundles. The owner decides who sees the terms behind a commitment.
Never stored by Regent: card numbers, CVVs, bank account numbers, wallet private keys, biometric data, identity documents. Card and bank instruments stay with the rail; identity documents and the face stay with the verification provider; Regent stores the verdict.
Retention
| Record | Kept |
|---|---|
| Receipts | ten years, in the organization’s anchored audit trail; the organization can export them at any time |
| Audit events, decisions, refusals | with the organization’s audit trail, hashed and anchored |
| Identity verification | the verdict and its date; re-checked on every money approval; an expired document or a deleted identity stops new authority |
| Provider credentials | until the organization removes them; rotation is the organization’s own action in the console |
Subprocessors
Services that process data on Regent’s behalf, and what each one sees:
| Subprocessor | Purpose | What it sees |
|---|---|---|
| authID | identity verification of owners | the owner’s document and face, under the provider’s own terms; Regent receives the verdict |
| Agentcard | card purchases at US merchants with the owner’s own card | the owner’s Agentcard profile and carts; Regent sees cart totals and store ids |
| Alibaba Cloud (United States, Virginia) | hosting of the services and databases | encrypted volumes of the platform |
| Amazon Web Services (KMS) | signing keys | signs with keys it holds; sees the bytes to sign, never the data behind them |
| Backblaze | encrypted off-site backups | encrypted archives only |
| PostHog | product analytics on the console and sites | page and click events of signed-in people; never agent payloads, decisions or receipts |
| Stripe | your own rail, with your own keys in the vault | the payments you make through it; Stripe is your processor, not Regent’s |
| A custody provider | the custody co-sign pilot | transfer requests it executes under a Regent decision |
Changes to this list are announced on the Changelog before they take effect.
Revocation and the kill switch
- Agent: revoking an agent suspends every mandate it holds within milliseconds; its next call
answers
AGENT_NOT_ACTIVEorMANDATE_SUSPENDED. The revocation is in the audit trail and the identity’s key log. - Mandate: revoking one mandate leaves the agent and its other mandates untouched.
- Owner: keys deleted at the identity provider, an expired identity document or a deleted identity stop all new authority; mandates already signed keep running until their own expiry, and the organization is told.
- Budget tokens: a budget envelope issued to a resource can be revoked at the resource; the resource’s reading settles what was spent.
- Connector sign-ins: a connector token is good for one hour and one agent; revoking the agent ends it early.
Reporting a problem
Write to the address on the site with what you saw and when. A confirmed report that affects other organizations is announced to them, and recorded on the Changelog once it is fixed. Independent assessments are listed on Status as they happen; none is claimed before it is done.